Why notes about other people deserve stronger protection

If your diary leaked, it would be humiliating and the damage would land on you. If your notes about friends leaked, the damage would land on people who never agreed to be written about, who cannot assess the risk, and who cannot do anything about it. Those are different categories of exposure, and it is worth being clear about why, because almost nobody thinks about the second one until it is too late.

Consent is the whole difference

A diary is a record of your own life, kept by you, exposing you. You accepted whatever risk exists by writing it, and you are the only person who bears the consequences.

A note about a friend is a record of someone else's life, kept by you, exposing them. They did not choose the storage. They did not choose the format. In most cases they do not know it exists. They told you something in a conversation, which is a bounded and deniable channel, and it has since become a durable, searchable record they have no control over.

That asymmetry is the entire argument. When you hold information about someone, you are holding it on terms they set implicitly and cannot enforce. Almost every disclosure between friends carries an unstated boundary — this is for you, in this conversation. Writing it down does not violate that boundary. Holding it carelessly does.

What is actually in these notes

It is easy to imagine the contents are trivial. In practice, the things worth remembering about people are frequently the things that would cause real harm if they escaped.

• Health. A diagnosis, a scan, a mental health difficulty, a pregnancy in the first trimester. Some of this is unknown to the person's own family.
• Work. That someone is interviewing elsewhere, hates their manager, expects to be laid off, or is planning to leave. Discovery of any of these can cost them their job.
• Relationships. A separation not yet announced, an affair, a fertility problem, an estrangement.
• Identity. Something about their sexuality, faith, immigration status, or politics that they are open about with you and not with their family, employer, or country.
• Third parties. Notes about a friend routinely contain facts about their partner, their children, their parents — people two steps removed who have even less connection to your decisions.

This is not a hypothetical list. It is roughly what any honest set of notes about people you are close to contains, because the things worth following up on tend to be exactly the things that are difficult.

The realistic ways it gets out

The imagined threat is a dramatic breach. The likely ones are much more mundane, which is part of why they get ignored.

Someone looks over your shoulder. On a train, in a meeting, at a kitchen table. Anything you can read at a glance, someone standing behind you can read at a glance.

You hand someone your unlocked phone. To show a photo, to let a child play a game, to let a friend type in their number. This happens constantly and requires no malice from anyone.

A search result surfaces it. You search for a word, and a line about someone's diagnosis appears in a preview while another person is looking at the screen.

An account is compromised. If notes are stored in an ordinary cloud account, they are as protected as that account's password and recovery email, which for most people is not very.

A service is breached, or changes. Any data held by a company in a form the company can read is data that can appear in a breach, be accessed by staff, be handed over under legal process, or be repurposed under a revised privacy policy. This is not a claim about any particular company's intentions; it is a description of what "readable by the provider" structurally means.

Devices change hands. Phones get sold, laptops get inherited, tablets get passed to relatives. Backups outlive the intention behind them.

What the exposure would actually cost

Two kinds of damage, and the second is worse and less obvious.

The direct damage is straightforward: someone's employer learns they are leaving, someone's family learns something they were not told, someone's private difficulty becomes a piece of local knowledge. Some of this is unrecoverable.

The indirect damage is to the friendship, and it happens even when nothing leaks — merely on discovery. The experience of learning that a friend has been keeping a durable record of your difficulties, in a place you cannot see, on terms you were never told, is genuinely unsettling regardless of the friend's motives. What was a conversation becomes, retroactively, a collection. Trust is difficult to restore after that, because the person now has to reassess every previous disclosure.

This is why the storage question is not a technical footnote. It is closely tied to whether the whole practice is defensible. Holding what someone told you in a form they would be comfortable with, if they knew, is the condition that makes remembering an act of care rather than an act of collection.

The standard worth applying

A reasonable test: would you be comfortable if the person could see exactly what you had written about them, and knew exactly where it was stored and who could reach it?

That test does two jobs at once. It governs content — it rules out judgments, assessments, and anything you would not say to their face — and it governs storage, because "on a service that can read it, protected by a password I reuse" is not an answer most people would want to give a friend.

Practically, the properties worth caring about are these. That the information is unreadable to anyone who obtains the file or the device, rather than merely hidden behind an app. That it is not casually visible on a screen you hand around. That you know where it physically lives and what would happen to it if the service disappeared. And that it can be genuinely deleted when it stops mattering, because a note about a friend's divorce has a natural end and should not outlive it by a decade.

The underlying point

None of this is an argument against remembering things about the people you care about. It is an argument that the information is not really yours, and that the level of care it deserves follows from whose life it describes rather than from whose device it sits on.

The ordinary intuition — my notes, my business — is the thing to correct. Your diary is your business. What your friend told you about their mother's prognosis is your friend's business, temporarily in your keeping. That is a smaller claim than ownership and a larger obligation than most people apply to it.